From 9deb4f1b114e40452a26e500f9818fcddb618c1e Mon Sep 17 00:00:00 2001
From: brandonkelly <brandon@pixelandtonic.com>
Date: Wed, 24 Jul 2024 11:48:59 -0700
Subject: [PATCH] Cleanup

---
 src/config/GeneralConfig.php    |  8 ++++----
 src/filters/Headers.php         | 13 ++++++++++---
 src/filters/SiteFilterTrait.php |  9 +++++++--
 src/web/Application.php         |  4 ++--
 4 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/src/config/GeneralConfig.php b/src/config/GeneralConfig.php
index c81678e84e8..f68b34dced4 100644
--- a/src/config/GeneralConfig.php
+++ b/src/config/GeneralConfig.php
@@ -203,7 +203,7 @@ class GeneralConfig extends BaseConfig
      *
      * @group GraphQL
      * @since 3.5.0
-     * @deprecated in 4.11.0 Use \craft\filters\Cors::class instead.
+     * @deprecated in 4.11.0. [[\craft\filters\Cors]] should be used instead.
      * @see https://www.yiiframework.com/doc/api/2.0/yii-filters-cors
      */
     public array|null|false $allowedGraphqlOrigins = null;
@@ -1977,7 +1977,7 @@ class GeneralConfig extends BaseConfig
      *
      * @group System
      * @since 3.6.14
-     * @deprecated in 4.11.0 Use \craft\filters\Headers::class instead
+     * @deprecated in 4.11.0. [[\craft\filters\Headers]] should be used instead.
      */
     public ?string $permissionsPolicyHeader = null;
 
@@ -3472,7 +3472,7 @@ public function allowAdminChanges(bool $value = true): self
      * @return self
      * @see $allowedGraphqlOrigins
      * @since 4.2.0
-     * @deprecated in 4.11.0 Use \craft\filters\Cors::class instead
+     * @deprecated in 4.11.0. [[\craft\filters\Cors]] should be used instead.
      * @see https://www.yiiframework.com/doc/api/2.0/yii-filters-cors
      */
     public function allowedGraphqlOrigins(array|null|false $value): self
@@ -5370,7 +5370,7 @@ public function pathParam(?string $value): self
      * @return self
      * @see $permissionsPolicyHeader
      * @since 4.2.0
-     * @deprecated in 4.11.0 Use \craft\filters\Headers::class instead.
+     * @deprecated in 4.11.0. [[\craft\filters\Headers]] should be used instead.
      */
     public function permissionsPolicyHeader(?string $value): self
     {
diff --git a/src/filters/Headers.php b/src/filters/Headers.php
index f1b5a7a8d50..aa6ab97a504 100644
--- a/src/filters/Headers.php
+++ b/src/filters/Headers.php
@@ -8,6 +8,7 @@
 namespace craft\filters;
 
 use Craft;
+use yii\base\ActionFilter;
 
 /**
  * Filter for adding arbitrary headers to site responses and handling OPTIONS requests.
@@ -15,16 +16,22 @@
  * @author Pixel & Tonic, Inc. <support@pixelandtonic.com>
  * @since 4.11.0
  */
-class Headers extends \yii\base\ActionFilter
+class Headers extends ActionFilter
 {
     use SiteFilterTrait;
 
+    /**
+     * @var array<string,string|string[]> The headers that should be set on responses.
+     */
     public array $headers = [];
 
     public function beforeAction($action): bool
     {
-        foreach ($this->headers as $name => $value) {
-            Craft::$app->getResponse()->getHeaders()->set($name, $value);
+        if (!empty($this->headers)) {
+            $responseHeaders = Craft::$app->getResponse()->getHeaders();
+            foreach ($this->headers as $name => $value) {
+                $responseHeaders->set($name, $value);
+            }
         }
 
         return true;
diff --git a/src/filters/SiteFilterTrait.php b/src/filters/SiteFilterTrait.php
index 5bf91a50633..94265651912 100644
--- a/src/filters/SiteFilterTrait.php
+++ b/src/filters/SiteFilterTrait.php
@@ -14,6 +14,7 @@
 /**
  * Trait to make a filter site-aware.
  *
+ * @property-write int|string|Site|array<int|string|Site> $site
  * @see https://www.yiiframework.com/doc/api/2.0/yii-filters-cors
  * @author Pixel & Tonic, Inc. <support@pixelandtonic.com>
  * @since 4.11.0
@@ -24,11 +25,11 @@ trait SiteFilterTrait
 
     protected function isActive(mixed $action): bool
     {
-        if (Craft::$app->getRequest()->isCpRequest || !$this->isCurrentSiteActive()) {
+        if (!parent::isActive($action)) {
             return false;
         }
 
-        return parent::isActive($action);
+        return !$this->isCurrentSiteActive();
     }
 
     protected function setSite(null|array|int|string|Site $value): void
@@ -59,6 +60,10 @@ private function getSiteId(int|string|Site $value): int
 
     private function isCurrentSiteActive(): bool
     {
+        if (!Craft::$app->getRequest()->getIsSiteRequest()) {
+            return false;
+        }
+
         return $this->siteIds === null || in_array(Craft::$app->getSites()->getCurrentSite()->id, $this->siteIds, true);
     }
 }
diff --git a/src/web/Application.php b/src/web/Application.php
index b1e77c4c790..f934e83aedc 100644
--- a/src/web/Application.php
+++ b/src/web/Application.php
@@ -640,8 +640,8 @@ private function _processActionRequest(Request $request): ?BaseResponse
 
                 // Return the response for OPTIONS requests that return null
                 // to support the CORS filter: https://www.yiiframework.com/doc/api/2.0/yii-filters-cors
-                return $response === null && $this->getRequest()->getIsOptions()
-                    ? $this->getResponse()
+                return $request->getIsOptions()
+                    ? ($response ?? $this->getResponse())
                     : $response;
             } catch (Throwable $e) {
                 $this->_unregisterDebugModule();